Уязвимость атаки типа "человек посередине" в PostgreSQL из-за некорректного использования параметров безопасности
Описание
В PostgreSQL обнаружена уязвимость, позволяющая злоумышленникам проводить атаки типа "человек посередине" или наблюдать незашифрованные передачи данных. Это возможно, если клиентская программа, создающая дополнительные соединения с базой данных, использует только основные параметры соединения и не учитывает параметры, связанные с безопасностью. Уязвимость угрожает конфиденциальности и целостности данных, а также доступности системы.
Затронутые версии ПО
- PostgreSQL версий до 13.1
- PostgreSQL версий до 12.5
- PostgreSQL версий до 11.10
- PostgreSQL версий до 10.15
- PostgreSQL версий до 9.6.20
- PostgreSQL версий до 9.5.24
Тип уязвимости
- Атака типа "человек посередине" (man-in-the-middle)
- Перехват данных
Ссылки
- Issue Tracking
- Mailing ListPatchThird Party Advisory
- Third Party Advisory
- Third Party Advisory
- Vendor Advisory
- Issue Tracking
- Mailing ListPatchThird Party Advisory
- Third Party Advisory
- Third Party Advisory
- Vendor Advisory
Уязвимые конфигурации
Одно из
EPSS
8.1 High
CVSS3
6.8 Medium
CVSS2
Дефекты
Связанные уязвимости
A flaw was found in PostgreSQL versions before 13.1, before 12.5, before 11.10, before 10.15, before 9.6.20 and before 9.5.24. If a client application that creates additional database connections only reuses the basic connection parameters while dropping security-relevant parameters, an opportunity for a man-in-the-middle attack, or the ability to observe clear-text transmissions, could exist. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
A flaw was found in PostgreSQL versions before 13.1, before 12.5, before 11.10, before 10.15, before 9.6.20 and before 9.5.24. If a client application that creates additional database connections only reuses the basic connection parameters while dropping security-relevant parameters, an opportunity for a man-in-the-middle attack, or the ability to observe clear-text transmissions, could exist. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
A flaw was found in PostgreSQL versions before 13.1 before 12.5 before 11.10 before 10.15 before 9.6.20 and before 9.5.24. If a client application that creates additional database connections only reuses the basic connection parameters while dropping security-relevant parameters an opportunity for a man-in-the-middle attack or the ability to observe clear-text transmissions could exist. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
A flaw was found in PostgreSQL versions before 13.1, before 12.5, befo ...
Use of a Broken or Risky Cryptographic Algorithm in PostgreSQL
EPSS
8.1 High
CVSS3
6.8 Medium
CVSS2